🔐 Password Generator
JA

Passphrase Generator

Generate a memorable, strong passphrase made of several English words.

—
StrengthWeak40 bits
Estimated crack time: 53 seconds

Words are chosen from a list of about 254 English words.

What a passphrase actually is

A passphrase is just a password made of several random words instead of a soup of symbols — think correct-horse-battery-staple rather than xK9#mQ2$. The words are picked at random from a big list, joined by a separator, and the result is something you can actually read and remember. It is the same idea as Diceware, a long-standing method of rolling dice to choose words from a list. The trick is that the words must be chosen randomly by the tool; a phrase you make up from a song lyric or a favorite quote is far more guessable than it feels.

Why random words can beat a gnarly symbol string

It feels backwards, but four or five random everyday words can be harder to crack than a short "complex" password — and you can remember it without writing it on a sticky note. The strength comes from the number of words and the size of the list they are drawn from, not from looking scary. Because each word is chosen randomly, an attacker cannot lean on the fact that they are common English words; they still have to account for every possible combination. The payoff is a credential that is both strong and human-friendly, which is exactly what you want for the passwords you have to type.

How many words do you actually need

For everyday logins, four random words is a reasonable floor; five or six is plenty for important accounts and master passwords. Each word you add multiplies the possibilities and pushes the entropy meter up by a fixed chunk, so going from four to six words makes a big difference. There is a sweet spot: long enough to be strong, short enough to type without sighing. If a phrase feels unwieldy, trim a word; if the strength meter looks low for something important, add one.

Separators, capitals, and numbers

The separator (a hyphen, space, period, or underscore) mostly affects readability — pick whatever is easiest for you to type, and note that some sites disallow spaces. Capitalizing each word and appending a number are handy mainly for getting past sites that demand an uppercase letter or a digit. They add a little to the mix, but the real strength still comes from the number of random words, so do not rely on a tacked-on "1!" to do the work. Adjust these toggles to satisfy a site's rules without making the phrase painful to enter.

Generated on your device, nothing leaves it

Like the password tool, the passphrase is assembled entirely in your browser using its built-in cryptographic randomness. Nothing is sent to a server and nothing is stored remotely — only your preferences (word count, separator, and the toggles) stay in local storage so the tool opens the way you like it. After the page loads you can go offline and keep generating, which doubles as a quick way to confirm that nothing about your passphrase is being transmitted.

When a passphrase is the better pick

Reach for a passphrase whenever a human has to type or memorize the secret: your password manager's master password, a laptop or phone login, a Wi-Fi key you read aloud to guests. For everything your password manager fills in automatically, a long random password from the other tab is more compact and works just as well. Many people use both — a memorable passphrase to unlock the vault, and random passwords inside it for every account.

Frequently asked questions

Is a passphrase weaker than a random password?
Not at all. With enough words a passphrase can be just as strong as a random password, or stronger, while still being something you can remember. The strength meter shows the entropy so you can compare — add a word or two if you want it higher for an important account.
Does it matter that the words are common English words?
No, because the tool chooses them randomly from a large list. Attackers already know the wordlist could be common words; what protects you is that they cannot predict which words came up, so they still have to reckon with every combination. The randomness is what counts, not obscurity.
How many words should I use?
Four random words is a sensible minimum for everyday accounts; use five or six for important logins and for a password manager master password. Each added word noticeably raises the entropy, so lean toward more words when the account matters and watch the strength meter respond.
Can I just make up my own memorable phrase instead?
It is safer to let the tool pick. Phrases people invent — song lyrics, quotes, "I love pizza 2024" — follow patterns that attackers target, so they are far weaker than they feel. Randomly chosen words avoid those patterns, which is exactly why this generator selects them for you.
Do I need a separator or a number?
Not for strength. Separators just make the phrase easier to read and type, and a capital letter or trailing number is mainly there to satisfy sites that require mixed case or a digit. The number of random words is what carries the security.
Where do the words come from — is it really random?
They are drawn from a fixed English wordlist using crypto.getRandomValues, the browser's cryptographically secure randomness, with rejection sampling so every word is equally likely. The selection happens on your device; the wordlist and logic are covered by automated tests.